@arcjet/skills 1.14.0 → 1.15.0

package/dist/version.js

@@ -1,5 +1,5 @@
 //#region src/version.ts
 /** Package version. Updated by the release process. */
-const VERSION = "1.14.0";
+const VERSION = "1.15.0";
 //#endregion
 export { VERSION };

package/docs/choose-protections.md

@@ -38,12 +38,13 @@ result is `{ detected, billing? }` (`text_units` when present). Check
 
 ## Data loss prevention
 
-Detection runs locally. The default WebAssembly backend finds exactly four
-structured types: card numbers, email addresses, phone numbers, and IP
-addresses. Names, addresses, and government or financial identifiers need
-`@arcjet/sensitive-info-rampart` (`rampart()`), which needs a server runtime
-with filesystem access. Listing a Rampart-only entity without that backend
-never matches.
+Detection runs on-device with `@arcjet/sensitive-info-rampart`
+(`backend: rampart()`), which finds names, addresses, government and
+financial identifiers, card numbers, email addresses, phone numbers, and IP
+addresses. It needs a server runtime with filesystem access (Node.js, Bun, or
+Deno), so its bundled loader can't run on Cloudflare Workers or edge
+runtimes. Always pass the backend; a Rampart entity listed without it never
+matches. The rule doesn't inherit the client's backend.
 
 **Rules:** `sensitiveInfo` (request-based) and `localDetectSensitiveInfo`
 (Guard).

package/docs/guard.md

@@ -36,28 +36,32 @@ Declare rules at module scope so `.deniedResult(decision)` and
 Call `guard()` where you already know the operation. Hardcode the `label`.
 Do not interpolate names in a generic dispatcher.
 
-Hardcode labels as slugs: lowercase letters, digits, `-`, `.`, and `_`
-(`tools.get-weather`). Start and end with a letter or digit; max 256 bytes.
+Hardcode labels as slugs: ASCII letters of either case, digits, `-`, `.`, and
+`_` (`tools.get-weather`). Start and end with a letter or digit; max 256 bytes.
+Labels match case-sensitively.
 Prefer dash/dot in new labels. Do not interpolate user input. Check a label
 you build yourself with `validateGuardLabel` — a slug the service will not
 match reads as `ALLOW` with `hasFailedOpen()` false.
 
 ```ts
-const decision = await arcjet.guard({
-  label: "tools.get-weather",
-  rules: [/* ... */],
-  metadata: { user: { id: userId } },
-});
-
-if (decision.conclusion === "DENY") {
-  const rateLimited = toolCallLimit.deniedResult(decision);
-  if (rateLimited) {
-    throw new Error(`rate limited – retry after unix ${rateLimited.resetAtUnixSeconds}`);
+async function getWeather(userId: string) {
+  const decision = await arcjet.guard({
+    label: "tools.get-weather",
+    rules: [/* ... */],
+    metadata: { user: { id: userId } },
+  });
+
+  if (decision.conclusion === "DENY") {
+    const rateLimited = toolCallLimit.deniedResult(decision);
+    if (rateLimited) {
+      throw new Error(`rate limited – retry after unix ${rateLimited.resetAtUnixSeconds}`);
+    }
+    if (decision.reason === "PROMPT_INJECTION") {
+      throw new Error("input flagged as prompt injection");
+    }
+    return { error: decision.reason };
   }
-  if (decision.reason === "PROMPT_INJECTION") {
-    throw new Error("input flagged as prompt injection");
-  }
-  return { error: decision.reason };
+  // ... run the tool
 }
 ```
 
@@ -85,10 +89,14 @@ never change the conclusion. Prefer `hasFailedOpen()` over deprecated
 Pass `correlationId` to join a guard decision with a request or agent
 trace. It is a dedicated field, not metadata.
 
-`localDetectSensitiveInfo()` defaults to WASM and matches four types:
-card, email, phone, IP. Names, addresses, and government / financial
-identifiers need `@arcjet/sensitive-info-rampart` (`backend: rampart()`).
-Listing a Rampart-only entity without that backend never matches.
+Use `localDetectSensitiveInfo({ backend: rampart() })` from
+`@arcjet/sensitive-info-rampart` for PII: it detects names, addresses,
+government / financial identifiers, card, email, phone, and IP on-device.
+Always pass the backend; a Rampart entity listed without it never matches.
+The rule doesn't inherit `launchArcjet({ sensitiveInfoBackend })`, so share
+one Rampart instance between the client and the rule. Rampart's bundled loader
+needs a filesystem; on Cloudflare Workers or other edge runtimes, pass
+`rampart()` a `classify` function that runs the model on your runtime.
 `moderateContent()` is Guard-only.
 
 ## Framework wrappers

package/docs/protect.md

@@ -66,8 +66,8 @@ Install the adapter with the project's package manager. Do not hand-edit
 ### Frameworks that are not a shared client file
 
 - **Astro** — register the integration in `astro.config.mjs` and import
-  `arcjet:client`. There is no `lib/arcjet.ts` and no `withRule()`.
-  `@arcjet/astro` validates with Zod `.strict()`, so leftover
+  `arcjet:client`. There is no `lib/arcjet.ts`; call `aj.withRule()` on
+  `arcjet:client` to add a rule to one route. `@arcjet/astro` validates with Zod `.strict()`, so leftover
   `detectPromptInjection({ threshold })` throws at startup.
 - **Nuxt** — register the `@arcjet/nuxt` module. The key lives in
   `nuxt.config.ts`. Import from `#arcjet`. Each `arcjet()` call is its own
@@ -131,6 +131,29 @@ Rules that need extra input at `protect()` time: `tokenBucket` needs
 `sensitiveInfo` needs `{ sensitiveInfoValue }`, `detectPromptInjection`
 needs `{ detectPromptInjectionMessage }`.
 
+Configure `sensitiveInfo` with `backend: rampart()` from
+`@arcjet/sensitive-info-rampart`, which detects PII on-device. Rampart runs on
+Node.js, Bun, and Deno; it can't run on Cloudflare Workers or edge runtimes.
+On Next.js, add it, `@huggingface/transformers`, and `onnxruntime-node` to
+`serverExternalPackages` and keep the route on the Node.js runtime (the
+default). On Astro, add the rule in the route with `aj.withRule()`, not in
+`astro.config.mjs`, and import `sensitiveInfo` from the `arcjet` core package:
+
+```ts
+// src/pages/api/chat.ts
+import { rampart } from "@arcjet/sensitive-info-rampart";
+import { sensitiveInfo } from "arcjet";
+import aj from "arcjet:client";
+
+const routeAj = aj.withRule(
+  sensitiveInfo({
+    mode: "LIVE",
+    deny: ["CREDIT_CARD_NUMBER", "EMAIL", "PHONE_NUMBER"],
+    backend: rampart(),
+  }),
+);
+```
+
 Pass `correlationId` when the decision must join another request, guard
 call, or agent trace. It does not affect fingerprinting.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arcjet/skills",
-  "version": "1.14.0",
+  "version": "1.15.0",
   "description": "Versioned Agent Skills for the Arcjet JavaScript SDK, shipped with TanStack Intent",
   "keywords": [
     "agent-skills",
@@ -56,9 +56,9 @@
     "test": "npm run build && npm run test-coverage && npm run validate-skills && node ../.github/scripts/check-skill-source-stale.mjs"
   },
   "devDependencies": {
-    "@tanstack/intent": "0.4.0",
-    "@types/node": "22.20.4",
-    "tsdown": "0.23.0",
+    "@tanstack/intent": "0.5.5",
+    "@types/node": "22.20.5",
+    "tsdown": "0.23.1",
     "typescript": "7.0.2"
   },
   "engines": {

package/skills/choose-protections/SKILL.md

@@ -7,7 +7,7 @@ metadata:
   author: arcjet
   type: core
   library: "@arcjet/skills"
-  library_version: "1.14.0" # x-release-please-version
+  library_version: "1.15.0" # x-release-please-version
 sources:
   - docs/choose-protections.md
 ---
@@ -23,8 +23,7 @@ or `@arcjet/skills#guard` to implement them.
 | SQLi / XSS / common probes | `shield` (`mode: "LIVE"`) | Request only |
 | Cost / abuse quotas | `tokenBucket`, `fixedWindow`, `slidingWindow` | Request and Guard |
 | Jailbreaks, instruction overrides | `detectPromptInjection` (binary; no `threshold`) | Request and Guard |
-| Card / email / phone / IP in text | `sensitiveInfo` / `localDetectSensitiveInfo` | Request and Guard |
-| Names, addresses, gov IDs | same rules + `@arcjet/sensitive-info-rampart` | Server runtime |
+| PII in text (names, addresses, gov IDs, card, email, phone, IP) | `sensitiveInfo` / `localDetectSensitiveInfo` + `backend: rampart()` | Request and Guard (server runtime) |
 | Unsafe / abusive text | `moderateContent` | Guard only |
 | Signup spam, disposable email | `validateEmail` + `protectSignup` | Request only |
 | VPN / Tor / country / IP lists | `filter` | Request only |
@@ -35,8 +34,10 @@ Sliding window: no boundary burst. Request rate limits default to IP; set
 `characteristics: ["userId"]` for a user key. Guard rate limits always need
 `key` and `bucket`.
 
-Default sensitive-info backend matches four structured types. Rampart-only
-entities never match without `backend: rampart()`.
+Sensitive-info rules use `@arcjet/sensitive-info-rampart`. Always pass
+`backend: rampart()` on the rule; Rampart entities never match without it.
+Rampart needs Node.js, Bun, or Deno – not Cloudflare Workers or edge
+runtimes.
 
 `capture()` records that an action happened. It is not a protection rule.
 

package/skills/cli/SKILL.md

@@ -7,7 +7,7 @@ metadata:
   author: arcjet
   type: core
   library: "@arcjet/skills"
-  library_version: "1.14.0" # x-release-please-version
+  library_version: "1.15.0" # x-release-please-version
 sources:
   - docs/cli.md
 ---

package/skills/guard/SKILL.md

@@ -7,7 +7,7 @@ metadata:
   author: arcjet
   type: core
   library: "@arcjet/skills"
-  library_version: "1.14.0" # x-release-please-version
+  library_version: "1.15.0" # x-release-please-version
 sources:
   - docs/guard.md
 ---
@@ -43,27 +43,31 @@ Declare rules at module scope so `.deniedResult(decision)` works.
 
 Hardcode the `label`. Do not interpolate in a generic dispatcher.
 
-Hardcode labels as slugs: lowercase letters, digits, `-`, `.`, and `_`
-(`tools.get-weather`). Start and end with a letter or digit; max 256 bytes.
+Hardcode labels as slugs: ASCII letters of either case, digits, `-`, `.`, and
+`_` (`tools.get-weather`). Start and end with a letter or digit; max 256 bytes.
+Labels match case-sensitively.
 Prefer dash/dot in new labels. Check a label you build yourself with
 `validateGuardLabel`.
 
 ```ts
-const decision = await arcjet.guard({
-  label: "tools.get-weather",
-  rules: [/* ... */],
-  metadata: { user: { id: userId } },
-});
-
-if (decision.conclusion === "DENY") {
-  const rateLimited = toolCallLimit.deniedResult(decision);
-  if (rateLimited) {
-    return { error: `rate limited, retry after ${rateLimited.resetAtUnixSeconds}` };
+async function getWeather(userId: string) {
+  const decision = await arcjet.guard({
+    label: "tools.get-weather",
+    rules: [/* ... */],
+    metadata: { user: { id: userId } },
+  });
+
+  if (decision.conclusion === "DENY") {
+    const rateLimited = toolCallLimit.deniedResult(decision);
+    if (rateLimited) {
+      return { error: `rate limited, retry after ${rateLimited.resetAtUnixSeconds}` };
+    }
+    return { error: decision.reason };
   }
-  return { error: decision.reason };
-}
-if (decision.hasFailedOpen()) {
-  // ALLOW only because a rule could not run — deny here if the site is sensitive
+  if (decision.hasFailedOpen()) {
+    // ALLOW only because a rule could not run — deny here if the site is sensitive
+  }
+  // ... run the tool
 }
 ```
 
@@ -72,8 +76,11 @@ the conclusion. Rate-limit rules need `key` and `bucket`. Nested `metadata`
 is Console-only; no secrets or PII. `decision.reason` is a flat string on
 DENY and `undefined` on ALLOW.
 
-`localDetectSensitiveInfo()` default backend matches card / email / phone /
-IP only. Names and government IDs need `backend: rampart()`.
+Use `localDetectSensitiveInfo({ backend: rampart() })` from
+`@arcjet/sensitive-info-rampart` for PII (names, addresses, government IDs,
+card, email, phone, IP). Always pass the backend on the rule – it doesn't
+inherit the client's `sensitiveInfoBackend`, so share one instance. On
+Cloudflare Workers or edge runtimes, pass `rampart()` a `classify` function.
 `moderateContent()` is Guard-only.
 
 `capture()` is visibility, never a deny. `flush()` on shutdown.

package/skills/mcp/SKILL.md

@@ -7,7 +7,7 @@ metadata:
   author: arcjet
   type: core
   library: "@arcjet/skills"
-  library_version: "1.14.0" # x-release-please-version
+  library_version: "1.15.0" # x-release-please-version
 sources:
   - docs/mcp.md
 ---

package/skills/protect/SKILL.md

@@ -7,7 +7,7 @@ metadata:
   author: arcjet
   type: core
   library: "@arcjet/skills"
-  library_version: "1.14.0" # x-release-please-version
+  library_version: "1.15.0" # x-release-please-version
 sources:
   - docs/protect.md
 ---
@@ -55,7 +55,8 @@ Omitted `mode` is `DRY_RUN`. `detectBot` requires exactly one of `allow` or
 One client. `withRule()` clones share the decision cache. A second
 `arcjet()` constructor does not.
 
-Astro is an integration (`arcjet:client`), not a shared file. Nuxt is a
+Astro is an integration (`arcjet:client`), not a shared file; add a
+per-route rule with `aj.withRule()` on `arcjet:client`. Nuxt is a
 module (`#arcjet`). NestJS is `ArcjetModule` + `@InjectArcjet()`. Bun and
 Deno wrap fetch with `aj.handler()` for IP detection, then still call
 `protect()`. Hono on Node passes `c.env.incoming`.
@@ -81,6 +82,14 @@ Branch only when the status differs: rate limit → 429; email / PII /
 prompt injection → 400; everything else → 403. `isErrored()` is fail-open —
 log and allow.
 
+Configure `sensitiveInfo` with `backend: rampart()` from
+`@arcjet/sensitive-info-rampart` (on-device PII detection). It runs on
+Node.js, Bun, and Deno – not Cloudflare Workers or edge runtimes. On Next.js,
+list it, `@huggingface/transformers`, and `onnxruntime-node` in
+`serverExternalPackages` and keep the route on the Node.js runtime. On Astro,
+add the rule in the route with `aj.withRule()` (import `sensitiveInfo` from
+`arcjet`), not in `astro.config.mjs`.
+
 Pass a trusted `userId` on the rule that needs it. Pass `correlationId`
 when the decision must join another request or guard call.